Operations · AWS baseline

Deploy the AWS baseline with Terraform; manage gateway resources in the console today.

A validated AWS deployment module is implemented. A customer-facing provider for routes, policies, budgets, and identities is planned.

Start in a test environment Read current API behavior

How the connection works

Provider access stays separate from application control.

Infrastructure deployment exists now

The repository carries the AWS module used by the release process, with explicit environments, version constraints, plans, and controlled apply roles. That is the current Terraform integration boundary.

Treat state as sensitive operating data

Terraform state binds configuration to remote objects and can contain sensitive values. The deployment baseline uses remote encrypted state and controlled access rather than presenting a local state file as a safe enterprise default.

Do not imply a provider that has not shipped

A customer-facing provider for gateway routes, policies, budgets, and identities remains planned. Those resources are self-service in the console and control API today, but they are not yet declarative Terraform resources.

Current shared controls

Status determines what can be configured.

Write-only, encrypted BYOK for implemented provider connections Stable model aliases and protocol-eligible route targets Organization and key budgets, RPM, TPM, and concurrency hard limits Observe, Shadow, Enforce, reason codes, and metadata-only evidence

Beta connections require customer validation against the exact model, payload, streaming mode, region, and provider account before production use.

Client boundary

AIGHQ_BASE_URL=https://api.aigatewayhq.com/v1
AIGHQ_API_KEY=from-your-workspace
AIGHQ_MODEL=company-approved-fast

Applications keep a stable gateway URL and model alias while an administrator changes eligible provider accounts and models.

Implemented boundary

Only documented protocols become eligible.

Use the validated AWS deployment module for a reviewed AI Gateway HQ environment. Route, policy, budget, and identity resources still use the customer console or control API; a public Terraform provider for those resources is not shipped.

Version-pinned Terraform AWS provider Remote encrypted state with locking Plan-then-apply release boundary

Compatibility is bounded to the provider's current published interface. Review the provider documentation before approving a production model.